Incident Response Activities

Exam objective 4.7: Summarize concepts associated with incident response activities.

This objective covers the life cycle an organization follows when something goes wrong: preparing before an incident through training, testing, tabletop exercises, playbooks, simulations, and defined roles; identifying incidents through detection, internal and external advisories, and threat hunting; investigating with digital forensics, chain of custody, e-discovery, and preservation; containing the damage through quarantine and isolation; handling negotiation when an adversary makes demands; eradicating the threat and recovering operations; notifying stakeholders, customers, law enforcement, and regulators; and closing the loop with lessons learned, root cause analysis, and post-incident reporting. Because the exam expects you to know where these activities come from, this chapter also covers the NIST SP 800-61 incident handling guidance that most organizations and most exam questions are built on.

This is a "summarize" objective. You will not be asked to run forensic tools here (that hands-on work belongs to Chapter 21), but you must know what each phase accomplishes, the order in which activities happen, and which activity best fits a described situation. Many questions take the form "What should the analyst do NEXT?" or "Which phase is the team in?", so focus on sequence and purpose as much as on definitions.

What Is an Incident?

NIST defines a security incident as an occurrence that actually or imminently jeopardizes the confidentiality, integrity, or availability of information or an information system, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

Separate three terms:

• An event is any observable occurrence in a system or network, such as a login or a dropped packet; nearly all events are benign.
• An alert is a notification generated when an event (or a pattern of events) matches a detection rule. Alerts may be true positives or false positives.
• An incident is an event or set of events confirmed to threaten CIA or violate policy, such as a ransomware infection or a compromised administrator account.

A breach is a specific kind of incident in which data is confirmed to have been disclosed to an unauthorized party. Breaches often trigger legal notification obligations.

Figure 20.1: Most events are benign, a smaller number raise alerts, fewer are confirmed incidents, and a breach is an incident with confirmed data disclosure

Exam tip

Not every event is an incident. A single failed login or a port scan blocked at the firewall calls for logging and monitoring, not activation of the incident response plan.

The Incident Response Life Cycle

The SY0-801 objective lists eight areas: preparation, identification, investigation, containment, negotiation, eradication/recovery, notification/external reporting, and post-incident activity. These map closely to the classic NIST life cycle. Understanding both the CompTIA list and NIST's model lets you answer questions written in either vocabulary.

Nist sp 800-61

NIST Special Publication 800-61, Computer Security Incident Handling Guide, is the most widely referenced incident response standard in the United States. Revision 2 (2012) defined the four-phase life cycle that most textbooks, and many exam questions, still use:

• 1. Preparation — policy, plan, team, tools, and training.
• 2. Detection and Analysis — recognizing, validating, scoping, and prioritizing an incident.
• 3. Containment, Eradication, and Recovery — limiting damage, removing the threat, restoring operations.
• 4. Post-Incident Activity — lessons learned, evidence retention, and process improvement. NIST draws the life cycle as a loop: post-incident activity feeds back into preparation, and teams often cycle between analysis and containment as new compromised hosts are discovered.

Figure 20.2: The NIST SP 800-61 Rev. 2 incident response life cycle, with its loops back to analysis and to preparation

Revision 3, published in April 2025, reorganized the guidance around the six functions of the NIST Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. Preparation is spread across Govern, Identify, and Protect; detection falls under Detect; containment and eradication under Respond; and restoration under Recover. Improvement becomes continuous rather than a final phase. The activities are the same; only the organization changed. CompTIA 4.7 area NIST 800-61 Rev. 2 phase CSF 2.0 function (Rev. 3)

• Preparation Preparation Govern, Identify, Protect
• Identification Detection and Analysis Detect
• Investigation Detection and Analysis (and throughout) Detect, Respond
• Containment Containment, Eradication, and Recovery Respond
• Negotiation Containment, Eradication, and Recovery Respond

Eradication/recovery Containment, Eradication, and Recovery Respond, Recover Notification/external reporting

Throughout (communication) Respond

Post-incident Post-Incident Activity Identify (improvement), all functions

Other models exist. The SANS PICERL model uses six steps: Preparation, Identification, Containment, Eradication, Recovery, and Lessons learned. ISO/IEC 27035 also defines an incident management process. If an exam question lists phases in a specific order, match it to the model it resembles—but in every model, preparation comes first, containment comes before eradication, and lessons learned comes last.

Memory aid

The core order never changes: Please Investigate Carefully, Eradicate, Recover, Learn — Preparation, Identification, Containment, Eradication, Recovery, Lessons learned. Investigation and notification run alongside the middle phases rather than in a strict slot.

Preparation

Preparation is everything done before an incident so that the organization can respond quickly and correctly when one occurs. An organization that discovers ransomware at 2:00 a.m. has no time to decide who is in charge or find the cyber insurer's phone number.

Preparation produces the incident response plan (IRP), a document that defines scope, authority, roles, severity levels, escalation paths, communication procedures, and the overall process. The plan is backed by an incident response policy (covered in Chapter 22) that establishes management's commitment and the team's authority. Preparation also includes acquiring tools (forensic workstations, write blockers, jump bags, out-of-band communications) and establishing relationships with law enforcement, counsel, a digital forensics and incident response (DFIR) retainer, and the cyber insurer.

Roles

Clear roles prevent confusion and duplicated effort. A computer security incident response team (CSIRT), sometimes called a CIRT or simply the IR team, typically includes:

Role Responsibility

Incident commander / IR manager

Leads the response, makes decisions, coordinates all parties, owns the timeline Security analysts and handlers

Triage alerts, analyze evidence, perform containment and eradication

Forensic investigators Acquire and analyze evidence while preserving its integrity IT and system owners Provide system knowledge, implement changes, restore services Legal counsel Advises on notification duties, privilege, evidence, law enforcement contact, and liability Role Responsibility

Communications / public relations

Prepares internal and external messaging; only authorized spokespeople talk to media Human resources Involved when an employee is a suspect or victim; ensures personnel actions follow policy

Executive sponsor / management

Authorizes major business decisions such as shutting down systems or paying a ransom Training

Training ensures that responders know the plan, the tools, and their individual responsibilities. Technical staff need forensics and tooling skills, executives and legal need to understand their decision points, and all employees need awareness training on recognizing and reporting incidents (Chapter 27).

Testing

Testing validates that the plan actually works. Testing may target a specific capability (can we restore the payroll database within four hours?) or the whole plan, and it reveals outdated contact lists, broken tools, and unrealistic assumptions before a real incident does.

Tabletop Exercises

A tabletop exercise is a discussion-based exercise in which participants gather (physically or virtually) and walk through a hypothetical incident scenario. A facilitator presents the scenario and introduces new developments ("injects"), and participants describe what they would do. No systems are touched. Tabletops are inexpensive, low risk, and especially good at testing decision-making, communication, and roles—for example, who decides whether to notify customers, or whether to take the e-commerce site offline.

Simulation

A simulation is a more realistic, operations-based exercise in which participants actually perform response actions in response to a scenario. Simulations may use a test environment, a cyber range, or a controlled red team attack in production, and they test technical skills and timing that a tabletop cannot. Exercise Format Systems touched?

Best for Cost and disruption

Tabletop Facilitated discussion of a scenario No Decisions, roles, communication

Low

Simulation Participants perform actions against a scenario

Yes (test or controlled)

Technical skills, timing, coordination

Moderate to high

Full-scale / functional

Multiple teams respond as if real Yes End-to-end validation High

If a question asks for the LEAST disruptive or least expensive way to test an incident response plan with executives and department heads, choose a tabletop exercise. If it asks for a way to validate that responders can actually perform technical steps under time pressure, choose a simulation.

Playbooks

A playbook is a documented, step-by-step set of actions for responding to a specific type of incident: phishing, ransomware, lost laptop, business email compromise, DDoS, or insider data theft. Playbooks turn the general plan into concrete checklists with decision points and escalation criteria, ensuring consistency regardless of who is on shift. They are often automated in a security orchestration, automation, and response (SOAR) platform (Chapter 19); a phishing playbook might extract URLs from a reported message, check them against threat intelligence, and purge copies from all mailboxes.

Note

Chapter 22 distinguishes a playbook (incident-type specific response guidance) from a runbook (step-by-step operational procedure for a specific task, often automatable). In practice the terms overlap; on the exam, "playbook" is the term associated with incident response.

Identification

Identification (NIST: detection and analysis) is the process of recognizing that an incident may be occurring, confirming it, and determining its scope, severity, and priority.

Detection

Detection is the discovery of indicators that something is wrong. Sources include:

• Security tools: SIEM correlation rules, EDR/XDR alerts, IDS/IPS signatures, DLP alerts, email security gateways, and cloud security posture tools (Chapter 17).
• Logs and anomalies: unusual logins, impossible travel, spikes in outbound traffic, new scheduled tasks, disabled security tools.
• People: users reporting phishing emails, help desk tickets about slow systems or locked files, an administrator noticing an unfamiliar account.
• Third parties: a customer, researcher, or law enforcement agency reporting malicious activity involving the organization.

Detection produces precursors (signs that an incident may happen, such as a threat actor's public announcement or reconnaissance scans) and indicators (signs that an incident has happened or is happening, such as malware alerts or encrypted files). Chapter 8 covers indicators of malicious activity in detail.

Once something is detected, analysts perform triage: validating whether the alert is a true positive, determining which systems and data are affected, and assigning a severity or priority. Prioritization weighs functional impact, information impact, and recoverability, and everything is documented in a case-management system from the first moment.

Internal Advisory

An internal advisory is a notice generated within the organization that warns of a threat, vulnerability, or active incident. Examples include a SOC bulletin warning staff of an active phishing campaign targeting the company, a vulnerability team notice that a critical server is exposed, or a message from IT that a particular application is behaving abnormally. Internal advisories can trigger identification activities ("check whether any of our hosts contacted this domain") and keep employees alert.

External Advisory

An external advisory comes from outside the organization: a vendor security bulletin, a government alert (for example, from CISA or the Canadian Centre for Cyber Security), an ISAC (information sharing and analysis center) notice for the organization's industry, a threat intelligence feed, or a CERT advisory. External advisories often include indicators of compromise (IoCs)—IP addresses, domains, file hashes— and descriptions of attacker tactics, techniques, and procedures (TTPs). Responders use them to search their own environment for evidence of the described activity.

Threat Hunting

Threat hunting is the proactive, human-driven search for threats that have evaded existing automated defenses. Rather than waiting for an alert, a hunter starts from a hypothesis—"If an attacker were using stolen credentials to move laterally, we would see a workstation authenticating to many servers it has never contacted before"—and then queries logs, EDR telemetry, and network data to confirm or refute it.

Hunts are driven by threat intelligence, advisories, and frameworks such as MITRE ATT&CK. A successful hunt either finds an incident or produces a new automated detection rule.

An industry ISAC publishes an external advisory describing a group that is exploiting a VPN appliance vulnerability and then creating local accounts named to resemble service accounts. The SOC lead issues an internal advisory to the infrastructure team and launches a threat hunt, searching VPN logs for the published attacker IP addresses and querying every appliance for recently created local accounts. The hunt finds one appliance with an account created three weeks earlier—an incident that no alert had flagged. The team moves into investigation and containment.

Common trap

Do not confuse threat hunting with vulnerability scanning or penetration testing. Vulnerability scanning looks for weaknesses that could be exploited. Penetration testing exploits weaknesses to prove risk. Threat hunting assumes an attacker may already be present and searches for evidence of their activity.

Investigation

Investigation is the collection and analysis of evidence to determine what happened, how it happened, what was affected, who was responsible, and whether the threat persists. Investigation begins during identification and continues through containment and eradication. The objective lists four elements: digital forensics, chain of custody, e-discovery, and preservation.

Digital Forensics

Digital forensics is the scientific collection, preservation, examination, and analysis of digital evidence in a way that maintains its integrity and makes it admissible in legal proceedings if necessary. The forensic process generally follows these steps:

• 1. Identification of potential evidence sources (endpoints, servers, logs, cloud accounts, mobile devices, network captures).
• 2. Collection/acquisition of evidence using forensically sound methods, in order of volatility (most volatile first: CPU registers and cache, memory, network state, running processes, then disk, then logs and backups, then archival media).
• 3. Preservation of the evidence so it cannot be altered: write blockers, hashing, secure storage.
• 4. Examination and analysis of copies (never originals): timeline building, malware analysis, log correlation, file recovery.
• 5. Reporting of findings in a clear, factual, defensible form.

Key practices include working only from verified copies, hashing evidence (SHA-256) at acquisition and verifying it later, recording clock offsets, and taking detailed notes of every action on a live system. Chapter 21 covers acquisition methods and the order of volatility in detail.

Chain of Custody

Chain of custody is the documented, unbroken record of everyone who handled a piece of evidence, when, where, and for what purpose, from the moment it was collected until it is presented or disposed of. Its purpose is to prove that the evidence presented is the same evidence that was collected and that it was not tampered with.

A chain of custody form typically records:

• A unique evidence identifier and description (make, model, serial number, hash value)
• Who collected it, when, where, and how
• Every transfer: who released it, who received it, the date and time, and the reason
• Where and how it was stored (sealed evidence bags, tamper-evident tape, locked evidence locker with access logging)

If the chain is broken—an evidence drive sat unattended on a desk for a weekend, or a transfer was not recorded—opposing counsel can argue that the evidence may have been altered, and a court may exclude it.

Figure 20.3: Chain of custody documents who controlled the evidence at every step, while matching hashes prove it was not changed

Common trap

Chain of custody proves who had control of the evidence. Hashing proves the evidence was not changed. You need both. A question that asks how to demonstrate that a disk image is identical to the original drive is asking about hashing; a question about documenting each person who handled the drive is asking about chain of custody.

E-Discovery

Electronic discovery (e-discovery) is the legal process of identifying, preserving, collecting, reviewing, and producing electronically stored information (ESI) in response to litigation, a regulatory investigation, or a legal request. E-discovery is driven by lawyers and courts rather than by the security team, but security and IT are responsible for locating and preserving the data: email, chat messages, documents, databases, logs, and backups.

E-discovery differs from forensics in purpose. Forensics asks "what happened on this system?" E-discovery asks "what relevant information do we hold, and how do we produce it?" An incident can lead to e-discovery when affected customers sue.

Preservation

Preservation means protecting evidence and relevant data from alteration, deletion, or destruction. In technical terms it includes imaging drives, capturing memory, copying logs to write-once storage, snapshotting cloud volumes, and suspending automatic log rotation or deletion. In legal terms it includes the legal hold (litigation hold): a formal instruction to custodians and IT to suspend normal retention and deletion policies for data relevant to anticipated or actual litigation. Chapter 25 discusses legal holds as a compliance obligation.

Preservation must begin early, because containment and eradication actions—rebooting a server, reimaging a laptop—can destroy volatile evidence. A help desk technician who reboots a compromised workstation "to clear the problem" wipes the attacker's processes and connections from memory; isolating it and calling the IR team would have preserved them.

Containment

Containment limits the scope and impact of an incident and prevents it from spreading, buying time for investigation and eradication. Containment decisions should be made according to predefined criteria in the IR plan and playbooks, because they often involve business trade-offs.

Quarantine and Isolation

The objective highlights quarantine/isolation:

• Isolation separates an affected system, network segment, or account from the rest of the environment. Examples include EDR network isolation of a host (only the EDR console can still talk to it), moving it to an isolated VLAN, disabling a switch port, or disabling a compromised account and revoking its tokens.
• Quarantine typically refers to placing a suspicious file, email, or device in a restricted holding area where it cannot cause harm but remains available for analysis. Antivirus quarantines files, email gateways quarantine messages, and NAC can quarantine a non-compliant device on a remediation

Vlan.

Related strategies include segmentation (limiting what an affected zone can reach) and sandboxing (running suspicious code in a controlled environment to observe it).

When choosing a containment strategy, weigh the damage that delay could cause, the need to preserve evidence, the business impact of disconnecting systems, the time and resources required, and whether the measure is a temporary workaround or a permanent fix.

Containment action What it limits Evidence impact

EDR network isolation of a host Lateral movement and C2 traffic from that host

Preserves memory and disk; host stays powered on

Disabling an account and revoking tokens Attacker use of stolen credentials Minimal; logs remain Blocking IPs and domains at firewall/DNS C2 and exfiltration to known infrastructure Minimal Moving a VLAN or segment behind a firewall

Spread between network zones Minimal

Powering off a system All activity on that system Destroys volatile evidence

Exam tip

When a question asks for the FIRST or BEST action after confirming that a host is infected with spreading malware, isolation (network disconnection while leaving the device powered on) is usually the answer. Powering off destroys volatile evidence; reimaging is eradication, which comes later.

Negotiation

Negotiation reflects the reality of extortion-based incidents. In ransomware and data-extortion attacks, the threat actor demands payment for a decryption key, for not publishing stolen data, or for stopping a DDoS attack. The organization may need to communicate with the attacker even if it never intends to pay. Key concepts:

• Decision authority: whether to engage or pay is a business decision made by executive leadership with legal counsel, not by the security analyst. The IR plan should define who has that authority.
• Professional negotiators: many organizations engage specialized ransomware negotiation firms, often through their cyber insurer or DFIR retainer. Negotiators can buy time, lower demands, and obtain "proof of life" such as a sample decrypted file.
• Legal and sanctions concerns: paying certain threat actors may violate sanctions laws (for example, US Treasury OFAC regulations prohibit payments to sanctioned individuals and groups). Legal counsel must evaluate this.
• Law enforcement involvement: agencies may have decryption keys from previous operations or intelligence about the group, and may advise against payment.
• No guarantees: paying does not guarantee working decryption or deletion of stolen data, and it funds criminal activity.

Common trap

On the exam, the security team does not decide unilaterally to pay a ransom. The best answers involve escalating to management and legal, involving law enforcement and the insurer, and pursuing recovery from backups. Restoring from clean, offline or immutable backups is always preferred to relying on an attacker's decryptor.

Eradication and Recovery

Eradication

Eradication removes the cause of the incident and every artifact of the attacker's presence from the environment. Eradication steps include:

• Removing malware, web shells, backdoors, and persistence mechanisms (scheduled tasks, services, registry run keys, startup items)
• Deleting or disabling attacker-created accounts and resetting passwords for compromised accounts, including service accounts and, in Active Directory compromises, the KRBTGT account (twice)
• Revoking and reissuing compromised certificates, API keys, and tokens
• Patching or mitigating the exploited vulnerability, and correcting the misconfiguration that allowed initial access
• Often, reimaging affected systems from known-good images, because it is hard to be certain a cleaned system is free of artifacts

Eradication must be complete across all affected systems at once; one forgotten foothold lets the attacker return.

Recovery

Recovery restores affected systems and services to normal operation and confirms that they are functioning correctly and are no longer compromised. Recovery activities include:

• Restoring data from clean backups that predate the compromise
• Rebuilding systems from hardened gold images
• Bringing systems back online in phases according to priorities in the business impact analysis (Chapter 23) and disaster recovery plan (Chapter 22)
• Increasing monitoring of restored systems to detect recurrence
• Validating functionality with business owners before closing the incident Recovery objectives such as RTO (recovery time objective) and RPO (recovery point objective), discussed in Chapter 13, guide how quickly systems must be restored and how much data loss is acceptable.

Notification and External Reporting

Incidents rarely stay internal. The objective lists four audiences: stakeholders, customers, law enforcement, and mandatory reporting. Notification should follow the communication plan in the IRP, which defines who may speak, what channels to use, and what approvals are needed.

Stakeholders

Stakeholders include executive leadership, the board of directors, business unit owners, legal, HR, communications, IT, and sometimes partners, investors, and the cyber insurer. Executives need timely, non-technical updates on impact and decisions required, and notifying the insurer early is often a condition of coverage.

Use out-of-band channels when the primary environment may be compromised; if attackers control email, discussing the response by email reveals the defenders' plans.

Customers

Customer notification is required when customer data is affected or when services customers rely on are disrupted. Notices, coordinated with legal and communications, explain what happened, what information was involved, what the organization is doing, and what customers should do. Inaccurate statements create liability; late ones can violate notification laws.

Law Enforcement

Law enforcement involvement is appropriate for criminal activity such as ransomware, extortion, and fraud—for example the FBI in the United States or the RCMP in Canada. Benefits include intelligence, possible recovery of funds, and prosecution; drawbacks include possible seizure of systems, publicity, and some loss of control over the investigation. The decision to involve law enforcement is made by management with legal counsel, and properly preserved evidence with an intact chain of custody becomes essential.

Mandatory Reporting

Mandatory reporting refers to notifications required by law, regulation, or contract:

• Data breach notification laws: all US states, Canada's PIPEDA (breaches posing a "real risk of significant harm" must be reported to the Privacy Commissioner and affected individuals), and the EU GDPR (notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible).
• Sector regulations: HIPAA for US healthcare; SEC rules requiring public companies to disclose material cybersecurity incidents (generally within four business days of determining materiality); critical infrastructure reporting laws.
• Contractual obligations: PCI DSS notification to card brands and acquirers; customer contracts requiring notice within a set period.

Missing a deadline can bring fines and lawsuits (Chapter 25), so the IR plan should list each obligation, its deadline, and who files it.

Audience Why notify Who approves

Internal stakeholders Decisions, resources, governance IR manager, executive sponsor Customers Affected data or service; legal duty; trust Legal, communications, executives Law enforcement Criminal activity; intelligence; prosecution Executives with legal counsel Regulators (mandatory)

Legal and regulatory requirement with deadlines Legal / compliance officer

Real-world scenario

A Canadian online retailer discovers that attackers accessed a database containing customer names, email addresses, and partial payment data. Legal counsel determines that the breach creates a real risk of significant harm, so the company must notify the Office of the Privacy Commissioner and affected customers, and keep a record of the breach. Because some customers live in the EU, GDPR's 72-hour supervisory authority notification also applies. The company's payment processor contract requires notice within 24 hours. The incident commander assigns the compliance officer to track each deadline while communications drafts customer notices for legal review.

Post-Incident Activity

The final phase turns an incident into improvement. NIST describes it as one of the most important and most often skipped parts of the process.

Lessons Learned

A lessons learned meeting (also called an after-action review or post-mortem) brings together everyone involved, ideally within a few days to two weeks after the incident while memories are fresh. The meeting should be blameless and focused on process. Typical questions include: What happened, and when? Were documented procedures followed and adequate? What information was needed sooner? Did any action destroy evidence or slow recovery? What would we do differently, and which indicators should we watch for in future?

Outputs include updates to the IR plan and playbooks, new detection rules, training needs, and budget requests.

Root Cause Analysis

Root cause analysis (RCA) identifies the fundamental reason an incident occurred, not just the immediate symptom. If ransomware encrypted servers, the symptom is encryption; the proximate cause may be a phishing email; the root cause may be that legacy authentication allowed password-only VPN access, or that patching of the VPN appliance was not tracked. Fixing only the symptom means the incident will recur.

Common RCA techniques include the five whys (asking "why?" repeatedly until reaching a correctable cause), fishbone (Ishikawa) diagrams that group contributing causes into people, process, technology, and environment, and timeline reconstruction.

Post-Incident Reporting (PIR)

The post-incident report (PIR) documents the incident formally. A good report includes an executive summary; a timeline of events from initial compromise through recovery; scope and impact (systems, data, users, financial cost); the root cause; actions taken in each phase; evidence handling; notifications made; lessons learned; and a prioritized list of recommendations with owners and due dates. The PIR serves management, auditors, regulators, insurers, and future responders. Evidence and reports must be retained according to the organization's retention policy and any legal holds.

Common metrics include mean time to detect (MTTD), mean time to respond (MTTR), and dwell time (how long the attacker was present before detection).

Exam tip

If a question asks which activity determines why an incident occurred so it can be prevented, the answer is root cause analysis. If it asks which activity reviews the team's performance and process, the answer is lessons learned. If it asks for the document summarizing the incident for management, the answer is the post-incident report.

Chapter Summary

• An event is any observable occurrence; an incident jeopardizes CIA or violates policy; a breach involves confirmed unauthorized disclosure of data.
• NIST SP 800-61 Rev. 2 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Rev. 3 (2025) maps incident response to the CSF 2.0 functions Govern, Identify, Protect, Detect, Respond, and Recover.
• Preparation includes the IR plan, defined roles, training, testing, tabletop exercises (discussion-based), simulations (hands-on), and playbooks for specific incident types.
• Identification uses detection tools and reports, internal advisories, external advisories from vendors, governments, and ISACs, and proactive threat hunting based on hypotheses.
• Investigation relies on digital forensics, an unbroken chain of custody, e-discovery for legal production of ESI, and preservation (including legal holds) of evidence.
• Containment through quarantine and isolation limits spread while preserving evidence; avoid powering off systems before volatile data is captured.
• Negotiation with extortionists is a business and legal decision involving executives, counsel, insurers, law enforcement, and specialist negotiators; sanctions law may prohibit payment.
• Eradication removes all attacker artifacts and fixes the root vulnerability; recovery restores and validates systems with heightened monitoring.
• Notification covers stakeholders, customers, law enforcement, and mandatory regulatory and contractual reporting with strict deadlines.
• Post-incident activity includes lessons learned, root cause analysis, and the post-incident report (PIR), which feed back into preparation.

Key Terms

Event; alert; incident; breach; NIST SP 800-61; NIST Cybersecurity Framework 2.0; incident response plan; CSIRT; incident commander; preparation; training; testing; tabletop exercise; simulation; playbook; SOAR; identification; detection; triage; precursor; indicator; internal advisory; external advisory; ISAC; threat hunting; investigation; digital forensics; order of volatility; chain of custody; e-discovery; electronically stored information; preservation; legal hold; containment; isolation; quarantine; negotiation; OFAC sanctions; eradication; recovery; reimaging; out-of-band communication; stakeholders; customer notification; law enforcement; mandatory reporting; lessons learned; root cause analysis; five whys; post-incident report; mean time to detect; mean time to respond; dwell time.

Review Questions

• 1. A company wants to evaluate whether its executives, legal counsel, and communications staff understand their decision-making responsibilities during a ransomware attack. The exercise must not affect production systems and should be inexpensive. Which approach BEST meets these requirements?

• A. Full-scale simulation
• B. Tabletop exercise
• C. Red team engagement
• D. Parallel processing test

• 2. A SOC analyst receives an EDR alert showing that a workstation is beaconing to a known command-and-control server. The analyst confirms the alert is a true positive. Which action should the analyst take

Next?

• A. Power off the workstation immediately
• B. Reimage the workstation from the gold image
• C. Isolate the workstation from the network using the EDR console
• D. Conduct a lessons learned meeting

• 3. A government agency publishes a bulletin listing IP addresses and file hashes associated with a campaign targeting the healthcare sector. A hospital's security team searches its SIEM for these indicators. What is the bulletin an example of?

• A. Internal advisory
• B. External advisory
• C. Playbook
• D. Post-incident report

• 4. A security analyst hypothesizes that an attacker may be using a legitimate remote administration tool to persist in the environment, even though no alerts have fired. The analyst queries EDR telemetry across all endpoints for unusual instances of the tool. Which activity is the analyst performing?

• A. Vulnerability scanning
• B. Penetration testing
• C. Threat hunting
• D. E-discovery

• 5. During an investigation, a forensic examiner removes a hard drive from a suspect laptop, places it in a sealed evidence bag, and records her name, the date and time, and the drive's serial number on a form. The drive is later transferred to a lab technician, who also signs the form. What is this process called?

• A. Legal hold
• B. Chain of custody
• C. E-discovery
• D. Order of volatility

• 6. A company receives notice that it is being sued by former customers following a data breach. The legal department instructs IT to suspend automatic deletion of email and logs related to the breach. Which concept does this BEST describe?

• A. Eradication
• B. Preservation through a legal hold
• C. Root cause analysis
• D. Quarantine

• 7. Ransomware operators have encrypted a company's file servers and threaten to publish stolen data unless paid. Which of the following are appropriate steps for the organization? (Select TWO.)

• A. Allow the SOC analyst on duty to negotiate and pay the ransom immediately to minimize downtime
• B. Involve executive leadership, legal counsel, and the cyber insurer in any negotiation decision
• C. Have legal counsel verify whether payment could violate sanctions regulations
• D. Delete all backups to prevent the attackers from encrypting them
• E. Avoid contacting law enforcement because it will automatically require payment

• 8. After removing malware from several servers, an IR team discovers that the attacker regained access through an account created during the initial compromise that was not disabled. Which phase was incomplete?

• A. Preparation
• B. Eradication
• C. Notification
• D. Lessons learned

• 9. Following a major incident, the security manager wants to understand the fundamental reason the incident occurred so that it does not recur, rather than just the immediate trigger. Which activity should be performed?

• A. Root cause analysis
• B. Tabletop exercise
• C. Threat hunting
• D. Quarantine

• 10. A publicly traded financial services company determines that a cyber incident is material to its business. Securities rules and its banking regulator require it to disclose the incident within a defined number of days. Which concept BEST describes this obligation?

• A. Internal advisory
• B. Stakeholder briefing
• C. Mandatory reporting
• D. Voluntary disclosure

• 11. An incident response team needs consistent, step-by-step guidance that any on-shift analyst can follow when a user reports a phishing email, including when to escalate. Which document should be created?

• A. Playbook
• B. Acceptable use policy
• C. Business impact analysis
• D. Chain of custody form

• 12. Which of the following are activities in the post-incident phase? (Select TWO.)

• A. Holding a lessons learned meeting
• B. Isolating affected hosts
• C. Producing a post-incident report
• D. Issuing an external advisory
• E. Capturing a memory dump of a running system

Answers and Explanations

• 1. B. A tabletop exercise is a discussion-based walkthrough of a scenario that tests roles, decisions, and communication without touching systems, making it inexpensive and non-disruptive. A full-scale simulation and red team engagement involve real activity and greater cost and risk. A parallel processing test is a disaster recovery test in which systems run at an alternate site, not a decision-focused exercise.
• 2. C. Once the alert is confirmed, the priority is containment while preserving evidence. EDR isolation cuts the host off from the network but leaves it powered on so memory can be captured. Powering off destroys volatile evidence. Reimaging is eradication and should not occur before evidence is collected and scope is understood. Lessons learned happens at the end.
• 3. B. An advisory from an outside source such as a government agency, vendor, or ISAC is an external advisory. An internal advisory would originate inside the hospital. A playbook is a response procedure, and a post-incident report documents a completed incident.
• 4. C. Proactively searching for evidence of an attacker based on a hypothesis, without waiting for an alert, is threat hunting. Vulnerability scanning looks for weaknesses, not attacker activity. Penetration testing exploits weaknesses with permission. E-discovery is a legal process for producing information.
• 5. B. Documenting each person who controls evidence, with dates, times, and identifying information, is chain of custody. A legal hold suspends deletion for litigation. E-discovery is producing ESI in legal proceedings. Order of volatility governs collection sequence.
• 6. B. Suspending normal deletion for data relevant to litigation is a legal hold, a form of preservation. Eradication removes threats, root cause analysis determines why an incident happened, and quarantine isolates suspicious items.
• 7. B, C. Negotiation and payment decisions belong to executives with legal counsel and usually the insurer, and counsel must check sanctions laws such as OFAC restrictions. An analyst should never decide to pay alone. Deleting backups destroys the best recovery option. Contacting law enforcement does not require payment; agencies often help and may have decryption keys.
• 8. B. Eradication requires removing all attacker artifacts, including accounts the attacker created. Leaving the account active allowed re-entry. Preparation, notification, and lessons learned are not where attacker access is removed, although lessons learned should capture this failure.
• 9. A. Root cause analysis identifies the underlying cause rather than the symptom. A tabletop tests the plan, threat hunting searches for active threats, and quarantine is a containment action.
• 10. C. A legal or regulatory requirement to report within a set time is mandatory reporting. Internal advisories and stakeholder briefings are internal communications, and voluntary disclosure by definition is not required.
• 11. A. A playbook gives step-by-step response actions and escalation criteria for a specific incident type such as phishing. An AUP defines acceptable behavior, a BIA analyzes business impact, and a chain of custody form documents evidence handling.
• 12. A, C. Lessons learned meetings and post-incident reports are post-incident activities. Isolating hosts is containment, external advisories come from outside sources and support identification, and memory capture is part of investigation.